libcrypto/curve25519/curve25519.c

68   int64_t h8 = load_3(s + 26) << 4;
85   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
91   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
101   h[8] = h8;
136   int32_t h8 = h[8];
149   q = (h8 + q) >> 26;
163   h8 += h7 >> 25; h7 &= kBottom25Bits;
164   h9 += h8 >> 26; h8 &= kBottom26Bits;
198   s[25] = (h7 >> 21) | ((uint32_t)(h8) << 4);
199   s[26] = h8 >> 4;
200   s[27] = h8 >> 12;
201   s[28] = (h8 >> 20) | ((uint32_t)(h9) << 6);
423   int64_t h8 = f0g8+f1g7_2 +f2g6   +f3g5_2 +f4g4   +f5g3_2 +f6g2   +f7g1_2 +f8g0   +f9g9_38;
437    *   i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
463   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
467   /* |h8| <= 1.41*2^60 */
470   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
472   /* |h8| <= 2^25; from now on fits into int32 unchanged */
492   h[8] = h8;
593   int64_t h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4   +f9f9_38;
616   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
619   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
633   h[8] = h8;
844   int64_t h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4   +f9f9_38;
865   h8 += h8;
878   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
881   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
895   h[8] = h8;
4784   int64_t h8 = f8 * (int64_t) 121666;
4801   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
4807   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
4817   h[8] = h8;